Analysis
-
max time kernel
5s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17-12-2024 12:54
Behavioral task
behavioral1
Sample
3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe
Resource
win10v2004-20241007-en
General
-
Target
3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe
-
Size
2.0MB
-
MD5
3f8d4a67e8e2d15220f4ec2cb0caf28c
-
SHA1
3fb979356e7978bc1663516e9ef93428635dcba3
-
SHA256
3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed
-
SHA512
5445ee21fe04d9772a3af88f31e5706b45d4c32533a9c230f70f66a2d50c637af6d7a43f96a85be68b786562e509a75ac345be92cc7758332a3987aec61f577d
-
SSDEEP
24576:su6J33O0c+JY5UZ+XC0kGso6FaI1IXgM6YmenKKSUlmDaGJTA4Pqa6jUvOkQwKYB:2u0c++OCvkGs9Fap5aLKLkDl+dUvO9YL
Malware Config
Extracted
azorult
http://0x21.in:8000/_az/
Extracted
quasar
1.3.0.0
EbayProfiles
5.8.88.191:443
sockartek.icu:443
QSR_MUTEX_0kBRNrRz5TDLEQouI0
-
encryption_key
MWhG6wsClMX8aJM2CVXT
-
install_name
winsock.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
win defender run
-
subdirectory
SubDir
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Azorult family
-
Quasar family
-
Quasar payload 3 IoCs
resource yara_rule behavioral2/files/0x0007000000023cc7-12.dat family_quasar behavioral2/memory/992-30-0x0000000000290000-0x00000000002EE000-memory.dmp family_quasar behavioral2/files/0x0007000000023cc9-46.dat family_quasar -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe -
Executes dropped EXE 3 IoCs
pid Process 3256 vnc.exe 992 windef.exe 2460 winsock.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\k: 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe File opened (read-only) \??\n: 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe File opened (read-only) \??\p: 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe File opened (read-only) \??\e: 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe File opened (read-only) \??\g: 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe File opened (read-only) \??\h: 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe File opened (read-only) \??\i: 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe File opened (read-only) \??\o: 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe File opened (read-only) \??\q: 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe File opened (read-only) \??\r: 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe File opened (read-only) \??\s: 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe File opened (read-only) \??\a: 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe File opened (read-only) \??\b: 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe File opened (read-only) \??\w: 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe File opened (read-only) \??\u: 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe File opened (read-only) \??\v: 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe File opened (read-only) \??\y: 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe File opened (read-only) \??\z: 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe File opened (read-only) \??\j: 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe File opened (read-only) \??\l: 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe File opened (read-only) \??\x: 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe File opened (read-only) \??\m: 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe File opened (read-only) \??\t: 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 11 ip-api.com -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x0007000000023cc9-46.dat autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2092 set thread context of 2272 2092 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe 88 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
pid pid_target Process procid_target 3968 3256 WerFault.exe 83 1236 2024 WerFault.exe 103 3800 2460 WerFault.exe 96 3720 4212 WerFault.exe 122 -
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language windef.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winsock.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 4304 PING.EXE 1572 PING.EXE -
Runs ping.exe 1 TTPs 2 IoCs
pid Process 4304 PING.EXE 1572 PING.EXE -
Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 856 schtasks.exe 3164 schtasks.exe 1816 schtasks.exe 1988 schtasks.exe 4124 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2092 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe 2092 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe 2092 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe 2092 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 992 windef.exe Token: SeDebugPrivilege 2460 winsock.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2460 winsock.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 2092 wrote to memory of 3256 2092 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe 83 PID 2092 wrote to memory of 3256 2092 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe 83 PID 2092 wrote to memory of 3256 2092 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe 83 PID 3256 wrote to memory of 4408 3256 vnc.exe 85 PID 3256 wrote to memory of 4408 3256 vnc.exe 85 PID 2092 wrote to memory of 992 2092 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe 86 PID 2092 wrote to memory of 992 2092 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe 86 PID 2092 wrote to memory of 992 2092 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe 86 PID 3256 wrote to memory of 4408 3256 vnc.exe 85 PID 2092 wrote to memory of 2272 2092 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe 88 PID 2092 wrote to memory of 2272 2092 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe 88 PID 2092 wrote to memory of 2272 2092 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe 88 PID 2092 wrote to memory of 2272 2092 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe 88 PID 2092 wrote to memory of 2272 2092 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe 88 PID 2092 wrote to memory of 856 2092 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe 90 PID 2092 wrote to memory of 856 2092 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe 90 PID 2092 wrote to memory of 856 2092 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe 90 PID 992 wrote to memory of 3164 992 windef.exe 94 PID 992 wrote to memory of 3164 992 windef.exe 94 PID 992 wrote to memory of 3164 992 windef.exe 94 PID 992 wrote to memory of 2460 992 windef.exe 96 PID 992 wrote to memory of 2460 992 windef.exe 96 PID 992 wrote to memory of 2460 992 windef.exe 96 PID 2460 wrote to memory of 1816 2460 winsock.exe 97 PID 2460 wrote to memory of 1816 2460 winsock.exe 97 PID 2460 wrote to memory of 1816 2460 winsock.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe"C:\Users\Admin\AppData\Local\Temp\3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe"1⤵
- Checks computer location settings
- Enumerates connected drives
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k3⤵PID:4408
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3256 -s 5603⤵
- Program crash
PID:3968
-
-
-
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\windef.exe" /rl HIGHEST /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3164
-
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1816
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ystHk1lhEemq.bat" "4⤵PID:3152
-
C:\Windows\SysWOW64\chcp.comchcp 650015⤵PID:4284
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost5⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4304
-
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"5⤵PID:4212
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f6⤵
- Scheduled Task/Job: Scheduled Task
PID:4124
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nAPwo0u4jA9m.bat" "6⤵PID:1352
-
C:\Windows\SysWOW64\chcp.comchcp 650017⤵PID:5112
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost7⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1572
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4212 -s 22606⤵
- Program crash
PID:3720
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 20204⤵
- Program crash
PID:3800
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe"C:\Users\Admin\AppData\Local\Temp\3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe"2⤵
- System Location Discovery: System Language Discovery
PID:2272
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:856
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3256 -ip 32561⤵PID:4516
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exeC:\Users\Admin\btpanui\SystemPropertiesPerformance.exe1⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"2⤵PID:2024
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k3⤵PID:3220
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 5203⤵
- Program crash
PID:1236
-
-
-
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"2⤵PID:4452
-
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"2⤵PID:1964
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F2⤵
- Scheduled Task/Job: Scheduled Task
PID:1988
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2024 -ip 20241⤵PID:1436
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2460 -ip 24601⤵PID:2576
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4212 -ip 42121⤵PID:4596
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:1236
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:3332
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD510eab9c2684febb5327b6976f2047587
SHA1a12ed54146a7f5c4c580416aecb899549712449e
SHA256f49dbd55029bfbc15134f7c6a4f967d6c39142c63f2e8f1f8c78fab108a2c928
SHA5127e5fd90fffae723bd0c662a90e0730b507805f072771ee673d1d8c262dbf60c8a03ba5fe088f699a97c2e886380de158b2ccd59ee62e3d012dd6dd14ea9d0e50
-
Filesize
208B
MD58f24689590f675c83f6671c3a3a7a62f
SHA17aea6806ff0a761499784867f583df03e83548fd
SHA2567e33cadf1864f6c9d876162e4b6379b195a20bc9911834997e03481759b2dde9
SHA51200693fe7bf6c33773d1c0d99cbeed37586281ae82ad08b40c622de9ee4b1eb0d57546fbba75c9a917bfe36724435f92c8c19ec294fb34b7063d1ce0c0b5c1f68
-
Filesize
405KB
MD5b8ba87ee4c3fc085a2fed0d839aadce1
SHA1b3a2e3256406330e8b1779199bb2b9865122d766
SHA2564e8a99cd33c9e5c747a3ce8f1a3e17824846f4a8f7cb0631aebd0815db2ce3a4
SHA5127a775a12cd5bcd182d64be0d31f800b456ca6d1b531189cea9c72e1940871cfe92ccd005938f67bfa4784ae44c54b3a7ea29a5bb59766e98c78bf53b680f2ab2
-
Filesize
349KB
MD5b4a202e03d4135484d0e730173abcc72
SHA101b30014545ea526c15a60931d676f9392ea0c70
SHA2567050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9
SHA512632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb
-
Filesize
208B
MD591d9a65e4b57f0f831e5d37a5ae9dee4
SHA15a2edf02b2b670b054491d69421ec18dbb36996f
SHA256391d34c86eda6e68534e0be74eb4abedd0bea7a4949d8322c27897c5a199d960
SHA512a7e62c4309a727148a0d138b83fb6c71462022662fc699a82e118d837dc93b16584fc31b0d6d169eddc4a942959b408720a07becae35b344e05e191a7d526ce6
-
Filesize
224B
MD54b135c44cac6782903d812e34f247b24
SHA10a28c9ff63d12e286985c7311337c21b14b904a1
SHA25683348b533ee3c82859eaff17d6368d6b1e8f99d9612bfebfabda5548c8507da0
SHA512333edf4cd6b950952ecdf50e4e1bb569c92497c3a4067a6c748acf53e51e9d06819b94383773192ff512bf725bc896ec1dda0ec1300a88891d7a545e505f354e
-
Filesize
2.0MB
MD59514688e22fcef0fa359d8d8f4d5b21d
SHA10c73816b737f747040ba15d80de6ce959b75b7c2
SHA256220b8e46ebf372cf4adcc4ba3c64d40a169faa07843a4cc3ee6914f26338917d
SHA51235e7db3b9b3d925e49995c1236ec0b5803af271c649cf768186bda54971e4675ce6792e3964b10d86d5ab37b39461da4ab86213b67bcce7b6f1ad63153edfc68